Breaking: HubSpot to End Form Submissions from Domain-Agnostic Websites

Starting from May 16, 2024, HubSpot will NOT receive form submissions from on-page forms on external websites that:

• Do not have HubSpot system domains (i.e. pages created directly in HubSpot)
  
• Do not have a connected custom domain
  
• Are not added as “trusted” domains in advanced tracking settings

It is a security update. According to HubSpot, the update is intended to curb malicious actions by bad actors, protecting HubSpot users from “potential phishing attacks via forms submitted from an external site that is not a trusted domain.” In simpler terms, trusted domains will prevent attackers from placing your forms on unrelated websites to steal user info. 

But What Does This All Mean?

Think of it like this: HubSpot is leaning toward a kind of whitelist arrangement. They’re blocking external communications from unverified sources.  

By adding an external website’s domain as “trusted,” you’re signaling to HubSpot that you recognize the website, and you want to receive form submissions on it. 

So if you have a form for collecting leads on your external blog, if you don’t add the website as a trusted domain, HubSpot will consider all form submissions on that page as spam. People may have read your blog posts and also submitted forms, but HubSpot will not recognize those actions. 

What Does This NOT Mean

Updates tend to trigger confusions and misunderstandings. Just to clarify, it is important to understand what the update does NOT mean:

• HubSpot is not doing away with Forms. You will still be able to create forms within HubSpot.
  
• You can still embed forms on external websites. Only make sure they’re added as trusted domains.
  
• Forms that you already have on trusted domains will continue to work as usual. These include HubSpot system domains and connected custom domains. 

In addition, the update does not affect how email addresses are handled. It has nothing to do with email domains submitted in the Email Property. HubSpot will accept email addresses from any domain. The restriction only applies to the website where the signup form is featured. 

The form update also does not apply if you are using a form integration that has a direct connection in HubSpot. Furthermore, as long as submissions happen via approved Forms API within HubSpot, the update has no bearing on the process.

How to Add A Trusted Domain?

Follow these steps to add external domains to HubSpot:

• Log in to your HubSpot account. Click the settings icon in the navigation bar.

• Go to Tracking & Analytics. Then click the Tracking Code button. 

• Select the Advanced Tracking tab.
  
• Click the +Add Domain option as shown below.

What Qualifies as Trusted Domains?

Any external domains you want to embed HubSpot or non-HubSpot forms on that are not added to the Additional Domains settings qualifies as trusted domains. 

But if you already have forms on trusted domains (e.g. on a page created directly in HubSpot), you don’t need to make any changes for those domains. 

How to Manage Spam Submissions?

If after adding an external website as a trusted domain, form submissions are routed to spam, you can manage spam submissions by following these steps:

• Log in to your HubSpot account. Go to Marketing. Click Lead Capture, then Forms.
  
• Search and review the form you want to analyze in the form table. You can check the number of spam submissions in the Spam Submissions column. Click all such submissions. 

Source

• Hover the submission you want to review, and click View Submission.
  
• You should see the following dialog box. If you think the submission is valid, click Release. This will release the submission and update your records. 

Source

What about Spam Notification Updates?

You will only receive notifications that do NOT go to spam, provided you have set this set up in your individual notification settings, and the same is included in the form’s notification settings. 

So HubSpot won’t send any specific spam-related notifications. If you have user notifications enabled and still don’t get them, chances are that HubSpot has sent a submission to spam. Learn how to set up user notifications in HubSpot. 

Keep in mind that the forms spam tool will only apply to HubSpot or non-HubSpot forms set up on external websites that will now need to be added as trusted domains. 

Get Started with A HubSpot Solutions Partner!

We at Mavlers are a HubSpot solutions partner. Our 25+-strong HubSpot team has delivered over 1,000 projects for more than 3,000 clients across the globe. Get in touch with our HubSpot experts for all kinds of development services, and more.